4 ms·

From what I read, the NSA has not recommended most crypto protocols due to quantum computing. However, they still recommend having a large key size as being one

From what I read, the NSA has not recommended most crypto protocols due to quantum computing. However, they still recommend having a large key size as being one of the biggest factors in having strong crypto. So why not use RSA with larger keys? Granted, I'm not an expert either. Let me put a source against this so people don't state the obvious about large enough quantum computers not existing and such: http://blog.bettercrypto.com/?p=1917 http://blog.bettercrypto.com/?p=1917

floatboth 7y ago
Bollocks, no one has a large enough quantum computer yet. What is known to exist is just small numbers of qubits, and they are extremely expensive to run. Key sizes are an attractive subject for bikeshedding. You can endlessly argue about whether better performance or stronger theoretical brute force resistance (e.g. billion years vs million years to crack) is more important. And yet, it is a silly thing to care about. Read the article, it does not even mention this topic really. It's all about implementation vulnerabilities, and how RSA is fundamentally resistant to correct implementation (requires padding, etc)
chaosite 7y ago
That's basically irrelevant to the point the article is making. The article's basic gist is that RSA implemented perfectly is fine, but that actually getting to that perfect implementation is hard and there are an incredible number of gotchas. And because the basic idea behind it is simple, then devs tend to try their hand at DIYing it./
lvh 7y ago
You would need an obscenely large key size to make RSA post-quantum secure. The speedup a quantum computer gives you isn't some linear factor. People have explored what that would look like: https://cr.yp.to/papers/pqrsa-20170419.pdf https://cr.yp.to/papers/pqrsa-20170419.pdf But more importantly: 1. No, quantum computers that big don't exist. 2. If they are somewhat practical, you really want perfect forward secrecy so they at least have to break a classically hard problem _every time_, which is unlikely with home-rolled RSA systems. 3. If you do care about post-quantum KEX (because your information needs to be secret for longer than you can count on quantum computers not being practical), we have faster alternatives, like SIDH.
- CiPHPerCoder 7y ago
  3a. Doing ECDH (e.g. over Curve25519) and SIDH (or SIKE, the NIST flavor of SIDH) and hashing both together (e.g. with BLAKE2) is a sensible insurance policy against breakthrough attacks against SIDH.

floatboth 7y ago

Bollocks, no one has a large enough quantum computer yet. What is known to exist is just small numbers of qubits, and they are extremely expensive to run. Key sizes are an attractive subject for bikeshedding. You can endlessly argue about whether better performance or stronger theoretical brute force resistance (e.g. billion years vs million years to crack) is more important. And yet, it is a silly thing to care about. Read the article, it does not even mention this topic really. It's all about implementation vulnerabilities, and how RSA is fundamentally resistant to correct implementation (requires padding, etc)

chaosite 7y ago

That's basically irrelevant to the point the article is making. The article's basic gist is that RSA implemented perfectly is fine, but that actually getting to that perfect implementation is hard and there are an incredible number of gotchas. And because the basic idea behind it is simple, then devs tend to try their hand at DIYing it./

lvh 7y ago

You would need an obscenely large key size to make RSA post-quantum secure. The speedup a quantum computer gives you isn't some linear factor. People have explored what that would look like: https://cr.yp.to/papers/pqrsa-20170419.pdf https://cr.yp.to/papers/pqrsa-20170419.pdf But more importantly: 1. No, quantum computers that big don't exist. 2. If they are somewhat practical, you really want perfect forward secrecy so they at least have to break a classically hard problem _every time_, which is unlikely with home-rolled RSA systems. 3. If you do care about post-quantum KEX (because your information needs to be secret for longer than you can count on quantum computers not being practical), we have faster alternatives, like SIDH.

CiPHPerCoder 7y ago
3a. Doing ECDH (e.g. over Curve25519) and SIDH (or SIKE, the NIST flavor of SIDH) and hashing both together (e.g. with BLAKE2) is a sensible insurance policy against breakthrough attacks against SIDH.